CVE-2025-54057

MediumCVSS 6.1

Published: 27/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

54th percentile - higher than 54% of all known CVEs

Summary

Apache SkyWalking contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags in web pages. The issue affects versions up to and including 10.2.0.

Risk Assessment

An attacker could inject malicious script that executes in the application user's browser, potentially leading to session or data theft.

Recommendation

Upgrade Apache SkyWalking to version 10.3.0, which fixes the issue.

Other vulnerabilities in Apache SkyWalking

CVE-2026-71216Medium
The PagerDuty alarm hook in Apache SkyWalking transmits the integration routing key over cleartext HTTP. Although PagerDuty serves over HTTPS and normally redirects plain HTTP to HTTPS, the initial POST request with the JSON body containing the routing key is sent unencrypted before any redirect response is received. The issue affects versions from 9.6.0 through 11.0.0.

Original NVD description (English source)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS